Using of small-scale quantum computers in cryptography with many-qubit entangled 

states. 
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We propose a new cryptographic protocol. It is suggested to encode information in ordinary 
binary form into many-qubit entangled states with the help of a quantum computer. A state of qubits 
(realized, e.g., with photons) is transmitted through a quantum channel to the addressee, who applies 
a quantum computer tuned to realize the inverse unitary transformation decoding of the message. 
Different ways of eavesdropping are considered, and an estimate of the time needed for determining 
the secret unitary transformation is given. It is shown that using even small quantum computers can 
serve as a basis for very efficient cryptographic protocols. For a suggested cryptographic protocol, 
the time scale on which communication can be considered secure is exponential in the number of 
qubits in the entangled states and in the number of gates used to construct the quantum network. 



I. INTRODUCTION 

In 1982 Feynman suggested that simulation of a quan- 
tum system using another such system could be more 
effective than using classical computers, which demand 
exponential time depending on the size of the sys- 
tem P. Later discussions focused on the possibility of 
using quantum-mechanical systems for solution of clas- 
sical problems. For example, Deutsch's algorithm Q of 
verification of a balanced function was the first quantum 
algorithm that worked more efficiently than the classical 
analog. 

The most famous of these, Shor's quantum factorizing 
algorithm 3], is capable of destroying widespread cryp- 
tographic system RSA That fact made a strong im- 
pression and speeded up the development of quantum 
cryptography [5( and quantum information processing in 
general. 

It is important to note that quantum mechanics de- 
stroying classical ways of coding still gives the possibility 
of constructing new ones. At present, there exist many 
ways of coding that use the quantum mechanics. 

As an example, the quantum algorithm of key distri- 
bution using orthogonal states should be mentioned 0. 
It was first experimentally realized by Bonnet and Bras- 
sard , who were able to carry out the transmission only 
at a distance of forty centimeters. Later, a communica- 
tion line of several kilometers was realized ;8j . 

Another example was first experimentally demon- 
strated in 1992 J3- The method uses pairs of entangled 
photons, part of which, with the help of Bell inequalities 
of a special form ^(jj can be used to reveal attempted 
eavesdropping. 

In the present article, another method of coding is pro- 
posed. It uses quantum computers for creating entangled 
states of several qubits. The safety of that method is 
based on the complexity of tomography for those states. 

Later, it will be convenient to treat a single qubit as 
a spin-i particle. To transmit information, Alice (the 
sender) first transfers it into a set of units and zeros and 
divides the numerals into groups of K bits. Then, for 



every group, she creates a set of K spins in pure states. 
The spin corresponding to a numeral gets the projection 
along the fixed Z-axis if the numeral is zero and projected 
opposite to the axis otherwise. After that, Alice em- 
ploys a preset unitary transformation U for every group 
of K spins, thus obtaining a set of entangled quantum- 
mechanical states that hereafter will be called messages: 



\*k) = U\k), 



(1) 



where \k) is an unentangled state of spins with certain 
projections along the Z-axis, and where the projections 
are defined by the sequence of units and zeros for the 
binary record of the number k. 

Having received K entangled spins, Bob (the receiver) 
employs the inverse unitary transformation U^ 1 , thus 
obtaining the original separable state of spins with de- 
fined projections, which can be measured and , thereby, 
the secret message can be decoded. 

It is natural that only Alice and Bob know the uni- 
tary transformation U, providing that Eve (eavesdrop- 
per), trying to measure the entangled quantum states, 
will obtain probabilistic results defined by the quantum 
mechanics. 

Further, we will consider the ways of learning how 
to decode the transmitted information and, very impor- 
tantly, how much time it takes. We will consider two 
different ways: quantum tomography of every entangled 
state and a simple guess of the quantum gate network. 
The obtained results allow an estimate to be made of how 
long Alice and Bob may safely use the unitary transfor- 
mation without changing it. 



II. QUANTUM TOMOGRAPHY OF AN 
ENTANGLED STATE. 



In the simplest case, Eve can determine the secret uni- 
tary transformation if she knows exactly what informa- 
tion is sent by Alice. We will not consider the question 
of how she can do that; we will just assume that, having 
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intercepted the message, Eve knows exactly what infor- 
mation is encoded by Alice. Thus, for simplicity, in this 
section we deal with many identical entangled states. 

The strategy for Eve is to employ quantum tomog- 
raphy for many identical intercepted entangled states. 
In hj it was shown that the density matrix of state 
of certain spins can be derived without using quantum 
computers. The idea of the method is based on a mea- 
surement of the probability p(tii, mi; UkjItik) for ev- 
ery spin §i projected into the state rrii along the direction 
rij. The density matrix is determined by the Monte-Carlo 
integration 
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operations, provided that we have a classical computer 
that can operate with 



N, 



data 



•>2K 



(8) 



complex numbers. 

On top of this, for practical applications, Eve must 
construct a quantum network by the unitary transfor- 
mation. As we will see in the next section, the number 
of necessary basic gates is 



N. 



gates 



)2K 



(9) 



Therefore, as Alice and Bob increase the number of bits 
contained in a single message, the number of necessary 
intercepted messages, the time necessary for deriving the 
unitary transformation and the complexity of the con- 
structed quantum network grow exponentially. 



where the kernel Ks i {ni-, m i) ac ts in the space of i-th 
spin. 

Let us introduce distance in space of density matrices 



III. GUESSING OF THE UNITARY 
TRANSFORMATION 
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It is known that, in the Monte-Carlo method, the rel- 
ative precision of integration converges as the inverse 
square of the number of points used I n our case 

we have 
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where TV is the number of different sets of directions used 
for measurement of spins. 

Now we note that, for every set of fixed directions and 
for every spin, it is necessary to measure all probabilities 
for every combination of indices {rrii}. This takes about 
Const * 2 K intercepted messages. 

Thus, we obtain that, in order to derive each density 
matrix with precision a it is necessary to intercept 



N, 



intercepted 



Const * a 



(5) 



messages. 

To compose the desired unitary transformation, Eve 
have to derive the density matrices {pk} for all 2 K en- 
tangled states. Every density matrix {pk} has a single 
eigenvalue, 1, and an eigenvector \^k) 



Pk = |*k)(*fc|- 



(0) 



Eve should find eigenvectors of the 2 K density matrices 
for all entangled states and put them together; thus, she 
will get the matrix 2 K x 2 K for the unitary transformation 
U in the basis composed of vectors \k). Since the prob- 
lem of finding eigen vector for a matrix takes about 2 2K 
elementary operations, the whole problem takes about 



N, 



operations 



(7) 



Complicated unitary transformations can be con- 
structed using simple ones which mix states of one or 
two qubits. Examples of actively studied gates for quan- 
tum networks are based on superconduc ting circuits 01 j 
resonant cavities Il4|. linear ion traps |15| and nuclear 
magnetic resonance |l6). 

The operation of a quantum computer can be pre- 
sented as a network of sequential simple unitary trans- 
formations. The whole unitary transformation has the 
form 



U = U M U M -i-U 2 U 1 



(10) 



Ekert and Jozsa showed |17| that any unitary trans- 
formation of qubits can be represented as a network of 
every possible single-qubit gate and one type of double- 
qubit gate. An example of double-qubit gate may can be 
"controlled NOT" , which acts like \a, b) -> \a, a 8 b). 

Due to the fact that every gate has its counterpart, 
which carries out the inverse transformation, we can sim- 
ply construct the inverse transformation: 



u- 1 = U^ L U 2 



fr 1 fr 1 

■ U M-1 U M ■ 



(11) 



Although the method of constructing of the quantum 
network by the matrix of the unitary transformation was 
presented in 0], in general case the algorithm requires 
a polynomial number of gates over the dimension of the 
matrix C/ _1 , thus, in our case, it takes a number of gates 
that is exponential in the number of qubits. Neverthe- 
less, Alice and Bob do not need to construct a quantum 
network to get a certain unitary transformation: instead, 
they can just agree on a particular one. 

We assume that Alice and Bob possess identical quan- 
tum computers which can carry out any of L different 
simple unitary transformations, provided that there ex- 
ists an inverse transformation for every one in the set. If 



3 



Alice and Bob use the simple transformations M times, 
then the number of possible quantum networks is 

N guant (L,M) = L M . (12) 

Eve has no chance to guess the correct unitary trans- 
formation trying every quantum network, taking into ac- 
count that M and L should be greater than the square 
number of qubits K 2 , because Alice and Bob, a least, 
need to mix every qubit with each over. 

As one can see, dependance (|T2l is again exponential. 
This formula yet does not take into account the fact that, 
for every trial network, Eve must do several measure- 
ments of quantum states to realize whether the network 
she has guessed is correct or not. Let 

P=\(k\U^! ess U\k)\ 2 (13) 

be the probability of erroneous acceptance of a trial uni- 
tary transformation U guess instead of the right one U . 
Then, the probability of not distinguishing this two trans- 
formations after n measurements is 

P=p n = e nlnp . (14) 

Since, for overwhelming majority of quantum networks, 
the probability p is far less than one, a few measurements 
are sufficient to realize that the network is erroneous. 

As a result, we conclude that, to increase the security 
of the cryptographic method, Alice and Bob should in- 
crease not only the number of qubits but also the number 
of quantum gates used. 

IV. THE CASE OF A PRIORI KNOWN TIME 
CORRELARIONS 

Earlier, we supposed that Eve knew what information 
was coded into the entangled states. Now we will assume 
that she knows only time correlations between messages 
of K classical bits. The correlations can be described by 
the value 

£,ki(y) = (p k {x)pi(x + y)) x , (15) 

where Pk(x) equals to unity, if x-th message is \k), and 
zero otherwise. 

We suppose that Eve possesses a priory information 
such as the frequencies of appearance and the correlations 
between K-bit messages that were sent by Alice. She 
tries then to construct a quantum network that gives the 
same frequencies and correlations. 

The estimated value of intercepted messages necessary 
for deduction of the unitary transformation is divided 
into two parts: the number of trial unitary transfor- 
mations and the number of necessary measurements for 
each of them to understand whether the correlations are 
proper or not. The first part of the problem is due to the 
entanglement, and the second is the same to the case of 
classical replacement cipher. 



The number of trial unitary transformations is defined 
by formula For calculation of the correlations, it is 

necessary to measure a number of quantum states that 
is polynomial in the value 2 K 

N cl » P n (2 K ) , (16) 

where the power n of the polynomial P n (x) corresponds 
to taking into account of long time correlations. 
The final number of messages to be intercepted is 

Nnet ~ Equant * N cl . (17) 

V. DISCUSSION 

In the suggested way of encoding information, the 
number of messages that Eve must intercept is exponen- 
tial in the number of qubits and quantum gates used. 
This is clearly seen from equations J5J), l|12[) and 1)17(1. 

According to the obtained estimations, it is necessary 
for Eve to derive the structure of all 2 K entangled states, 
that is, to intercept 

N^Cx2 2K (18) 

messages. This corresponds to transmission of 

N blt ~Kx2 2K (19) 

bits of classical information. 

On the contrary, according to (|12fl it is necessary for 
Alice and Bob to preset M numbers less than L to de- 
fine the order of simple unitary transformations. As we 
pointed earlier, M and K are of order K 2 , therefore, the 
number of bits required for this is 

N key ~K 2 *\og 2 K 2 . (20) 

This expression gives the length of the secret key that 
must be shared by Alice and Bob. They can use a proto- 
col of quantum key distribution to get it. Expression l|19|) 
shows how many classical bits can be safely transmitted 
using that secret key. 

Let us estimate the length of time that Alice and Bob 
may use a given unitary transformation without changing 
it. For this, let us consider the enciphering of telephone 
calls, which require transmission of about fifty thousand 
bits per second. If the quantum computer operates with 
K = 8 qubits, then according to our estimates, Eve 
should intercept TV « 65 * 10 3 messages, so Alice can 
send about N * K — 5*1 5 classical bits or can talk 
to Bob for ten seconds. If the computer operates with 
K = 16 qubits, then the time of guessing of the unitary 
transformation equals to several weeks. And in the case 
of K = 24 qubits the time of secure conversation for Alice 
and Bob rises to four thousand years. 

Although the suggested protocol requires a preset se- 
cret key, it still has an advantage over classical block 
cipher algorithms, which are also believed to be secure 



4 



for transmission of an exponential number of bits in the 
length of the key. The example of RSA system and Shor's 
algorithm shows that quantum mechanics can greatly 
simplify the breaking of codes based on complexity of 
classical algorithms. On the contrary, the safety of the 
suggested protocol is assured by fundamental laws of na- 
ture. 

The main advantage of the suggested protocol is that 
Alice and Bob, having arranged the secret transformation 
once, can use it for a long time. The transmission is 
carried out in one direction, as opposed to the protocols 
of secret key distribution, which require repeated back- 
and-forth transmissions from Alice to Bob. 

It should be mentioned that, according to the section 
IIVI the problem of determination of the secret unitary 
transformation is added to the classical cryptographic 
problems. The main source of additional security is 
the fact that the cloning of a state is forbidden in any 
quantum- mechanical system |l8| . Due to this theorem, a 
measurement in a wrong basis may give less information 
than in the classical case, where an intercepted message 
can readily be used for correlations calculation. In the 
quantum case, a part of intercepted entangled states will 
be an inevitable distraction for determination of the se- 
cret unitary transformation. 

Another issue is that, according to the noncloning the- 
orem |l8j . Eve destroys the quantum state measuring it 
in a wrong basis, and, therefore, she is unable to send the 
same state to Bob. In accordance with basic principles 
of quantum cryptography 6], Bob can easily notice the 
attempts of eavesdropping, and he can ask Alice to stop 
the transmission. In another similarity to the case of rel- 
ativistic quantum cryptography 19], Bob can detect the 
attempted eavesdropping by the time delay for incoming 
messages. 

Although the considered protocol looks promising, 



there are some problems in its realization. First, it ap- 
pears that the construction of quantum computers han- 
dling with tens of qubits is still a matter of the fu- 
ture. Second, due to small decoherence times for the 
systems with massive entangled particles, photons re- 
main the best objects for transmission of quantum states, 
but the conversion of a state of qubits into a state of 
photons is a challenging problem for experimentalists. 
Nevertheless, some efforts have been made to study cou- 
pling between photons and qubits po| and to convert 
pairs of spin-entan gled electrons to pairs of polarization- 
entangled photons [21j. Finally, during the transmis- 
sion of photons, there is the inevitable influence of the 
medium on their states, and, therefore, the use of some 
quantum error-correction techniques will be needed [2l| • 

To conclude, we presented estimates showing that for 
the suggested cryptographic protocol, the time that a 
secure secret unitary transformation can be used is ex- 
ponential in the number of qubits within the entangled 
states and in the number of gates used to construct the 
quantum network. 

Although we can not at the moment present a rigorous 
proof of the proper statements for Eve's general attack, 
the suggested protocol in our opinion can serve as an in- 
teresting alternative to the existing schemes in quantum 
cryptography. The main advantage of the cryptographic 
protocol is that using even relatively small quantum com- 
puters with several dozen qubits allows for a practical 
scheme that is more efficient than existing ones in several 
respects (e.g. weaker loading of communication channel) . 
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